Hello Paul, Paul Wise [2019-09-18 12:20 +0800]: > Linux fanotify now supports detecting file renames, it would be nice to > have support for those (AFAICT there is no support for them yet) and for any > other fanotify events that have been added in recent years.
This isn't the first time I get this request, and it has bothered me as well. Detecting renames and also deletions should be possible with the very new (Linux 5.1, i. e. 4 months old) FAN_REPORT_FID mode. I made some initial experiments with this today [1], on kernel 5.3. (Note that this won't eventually look like this, there needs to be a fallback for older kernels.) But so far this isn't encouraging -- the results for "normal" open/close/read/write are much worse. In particular, I get a lot of ESTALE event fds now that previously resolved to existing files just fine, and also the pid → /proc/pid/comm resolution is now much less reliable. Currently this feels like a bad trade-off to make, but I'll investigate this further. Martin [1] https://paste.fedoraproject.org/paste/6IjETdiFcz3E3hrYWilbqA
